Remarks 

In response to the Office Action dated October 15, 2008, Applicants respectfully request 
reconsideration based on the above claim amendment and the following remarks. Applicants 
respectfully submit that the claims as presented are in condition for allowance. Claims 1,4, 11- 
12, 14, 25, 36, 43, 49, 60, 69, 78, and 84 have been amended. 

Claim Rejections - 35 U.S.C. §112 

Claims 1-5, 7-39, 41-52, 54-87 stand rejected under 35 USC §1 12 second paragraph, as 
being indefinite for failing to particularly point and distinctly claim the subject matter which 
applicant regards as the invention. Specifically, independent claims 1, 14, 25, 60, 69, 78 and 84 
stand rejected for including the recitation "the content" which allegedly lacks antecedent basis. 
The recitation has been amended to read "a content". As such, the independent claims have 
antecedent basis. Therefore the rejections may be withdrawn. 

Claim Rejections - 35 U.S.C. §103 

Claims 1-5, 7-39, and 41-52 and 54-87 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Sharon (U.S. Pat. 6,137,782), in view of Galand (U.S. Pat. 6, 529,475) and 
further in view of Messinger et al. (U.S. Pat. 6,687,750). The rejection of these claims is 
respectfully traversed. 

It is respectfully submitted that the combination of Sharon, Galand and Messinger fails 
to describe each and every feature specified in amended independent claim 1. In its rejection, the 
Office Action concedes that Sharon fails to describe a) that a packet state includes a congested 
state; b) creating a histogram file; c) analyzing the stored traffic log to determine the time of 
creation of the traffic log and updating the histogram using at least the time of creation of the 
traffic log or d) that the histogram file is utilized to monitor network conditions in near real-time 
enabling the detection and correction of network overloads and congestion before network 
customers are affected. The Office Action proceeds by asserting that Galand describes a) that 
the packet state includes a congested state. 

The Office Action also concedes that the combination of Sharon and Galand fails to 
describe recitations b, c and d, above. The Office Action proceeds further by asserting that 
Messinger cures these conceded deficiencies in the combination of Sharon and Galand. 
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Claims 1-5 and 7-13 

Without conceding the correctness of the rejection, claim 1 has been amended to clarify 
that the traffic log being generated is a traffic log specific to a particular packet. Amended 
independent claim 1 recites, in pertinent part: 

"[a] method of monitoring a packet-switched network using traffic logs, comprising. . . 

(b) generating, at a first location within the packet-switched network, a traffic log specific 
to a particular packet based upon detection of a content of the packet, the traffic log containing a 
plurality of values detected within the packet comprising a network entry point of the packet, a 
network exit point of the packet, and a packet state, wherein the packet state includes a congested 
indication . . . 

(e) analyzing the stored traffic log to determine the time of creation of the traffic log and 
one or more nodes of a path traversed by the packet through the packet switched network from 
the network entry point to the network exit point. . ." 

Applicants respectfully assert that in addition to the conceded deficiencies in the 
combination of Sharon and Galand listed above, the combination of Sharon, Galand and 
Messinger fails to describe "generating. . .a traffic log specific to a particular packet based 
upon detection of a content of the packet the traffic log containing a plurality of values detected 
within the packet comprising a network entry point of the packet, a network exit point of the 
packet, and a packet state". Sharon also fails to describe "analyzing the stored traffic log to 
determine the time of creation of the traffic log and one or more nodes of a path taken by 
the packet through the packet switched network from the network entry point to the 
network exit point". 

Sharon addresses a method for automatically analyzing the traffic topology of a network 
by correlating information received from "agents" dispersed throughout a known physical 
network. (Abstract). The flow of packets is analyzed by detecting the packets as they are 
transported through a node in the network. (Col. 3, 1 62-63) and sorting the destination and 
source addresses to determine traffic information flowing between each pair of nodes. (Col. 3, 1. 
66- Col. 4, 1. 4). Each agent collects any (i.e., all) information received by a network 
card/connector (Col. 6, 1. 48-51) local to the agent. The traffic information is sent to a network 
parser 34 which then filters each frame according to a characteristic of the frame such as source 
address, destination address, type of frame and protocol. The network parser 34 then 
summarizes the aggregated sorted data and stores it in a database (Col. 6, 1. 65-Col. 7, 1. 7). 
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As such, Sharon is describing the capture of aggregated traffic information at a first 
location, transferring it to a second location and then sorting the information at the second 
location according to frame characteristics. The description in Sharon is contrary to amended 
claim 1 which recites generating, at a first location within the packet-switched network, a traffic 
log specific to a particular packet based upon detection of a content of the packet the traffic log 
containing a plurality of values detected within the packet comprising a network entry point of 
the packet, a network exit point of the packet, and a packet state . . .". Capturing aggregated 
information at a first location about a multitude of packets passing through a node and storing 
that information in a database is not generating at a first location. . .a traffic log specific to a 
particular packet based upon detection of a content of the packet. As such, Sharon fails to 
describe generating at a first location. . .a traffic log specific to a particular packet based upon 
detection of a content of the packet" because Sharon describes capturing aggregated data instead. 

Applicants respectfully note that Galand fails to cure this discrepancy in Sharon. Galand 
is concerned with a congestion detection and control in a packet switched network. Galand 
describes that when a congestion situation is encountered by a packet at a node the node sets a 
packet header field to "1". When the congestion field is detected at the destination end-user, the 
end-user device sets a congestion field set to "1" in a return packet so that when the return packet 
reaches the sending end-user a counter is incremented or decremented thereby providing a 
feedback mechanism to the sending unit to take congestion control actions. Galand is not 
describing "generating, at a first location within the packet-switched network, a traffic log 
specific to a particular packet based upon detection of a content of the packet ..." There is no 
description of a traffic log specific to a particular packet described in Galand. Setting a header 
field to "1" or incrementing a counter at a sending device is not generating a traffic log specific 
to a particular packet. A packet is not also a packet log. As such, Galand fails to cure this 
discrepancy in Sharon. 

Messinger is concerned with assembling aggregated network information in a database 
and then querying the database for information about a network node to be rendered as a visual 
display. Messinger describes that routers collect aggregated information about all of the data 
that passes through them. A reporting application monitors the state of each network component 
as the data transits the network and stores the aggregated information in a network information 
storage file from which it is subsequently retrieved for display. (Col. 1, 1. 64-67). The reporting 
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application appends the new results to the storage files 204-208. The user then manually queries 
the storage files 204-208 using filters for later use in the visualization application. Messinger is 
silent as to what information is collected at the router or what data is stored in the information 
storage files 204-208. Messinger also fails to describe "generating, at a first location . . .a traffic 
log specific to a particular packet ..." To the contrary, Messinger describes collecting 
aggregated data. As such, Messinger fails to cure this deficiency in the combination of Sharon 
and Galand. 

Therefore because none of Sharon, Galand or Messinger describes "generating, at a first 
location. . a traffic log specific to a particular packet. . .", their combination also fails to 
describe "generating, at a first location . . a traffic log specific to a particular packet. . .". As 
such, amended independent claim 1 is allowable over the combination of Sharon, Galand and 
Messinger for at least his reason due to a lack of a prima facie case of obviousness. 

Further, the Applicants respectfully assert that the combination of Sharon, Galand and 
Messinger fails to describe, ". . .analyzing the stored traffic log to determine. . .one or more nodes 
of a path traversed by the packet through the packet switched network from the network entry 
point to the network exit point" as recited in amended independent claiml . 

In its rejection on page 5, the Office Action asserts that Sharon describes "analyzing the 
network entry and exit points of the packet" and specifically cites Column 8, lines 10-30 in 
support of its assertion. However, Applicants respectfully point out that the cited portion of 
Sharon fails to describe the subject matter asserted to Sharon by the Office Action. The cited 
portion of Sharon merely describes that the "network parser 34 analyzes the header in each 
received packet for source and destination [IP] addresses. . ." Applicants respectfully assert 
that a packet header is not a stored log traffic file and that determining a source and destination 
address of a packet does not describe determining one or more nodes of a path traversed by the 
packet through the packet switched network from the network entry point to the network exit 
point a network entry point of the packet or a network exit point of the packet. 

As discussed above, Sharon fails to describe a log file specific to a particular packet. In 
addition, a source/destination address (i.e. an end-user device) as described by Sharon is not a 
network entry or exit point. A distinction exists between a source/destination device (i.e., an 
end-user computer) and a network entry/exit point. A source/destination device (i.e., an end-user 
device) may communicate via a network and have an IP/MAC address but is not part of the 
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network nor is it an entry or exit point of the network. A source/destination device is connected 
to a network by an edge router or a modem. An edge router/modem of a network device must 
establish access to/from the network for a source/destination computing device in order for the 
source/destination computing device to communicate via a network. In contrast, a network 
entry/exit point is by definition part of the network. As such, a network entry/exit point is not a 
source or a destination computing device and vice versa. 

As a further example, in traveling from the source address (i.e. a sender) to a destination 
address (a recipient), a packet may transit within or across one or more networks other than the 
network that is being monitored. In such a case, the packet may enter and exit more than one 
network. Each network would then have its own entry and exit point. As such, a source and/or 
destination address (i.e. end users) may not have even the most tenuous relationship with the 
packet's entry or exit point of the particular network being monitored. Because source and 
destination addresses apply to the sending and receiving end users and entry and exit points are 
structural parts of a specific network, source/destination addresses are fundamentally different 
from entry/exit points of a network even when there is only a single intervening network. 
Therefore, because Sharon fails to describe analyzing the stored traffic log to determine one or 
more nodes of a path traversed by the packet through the packet switched network from the 
network entry point to the network exit point, Sharon fails subject matter asserted to Sharon by 
the Office Action. 

As discussed above, Galand is concerned with incrementing a congestion counter at the 
sending device. Galand also describes differences between a source/destination and an entry/exit 
or exit point of a network. (FIG. 2, Gig. 8, Col. 3, 1. 28-58; Col. 6, 1. 26-51). Galand also 
describes that the data flow at ach node is monitored to detect congestion at the node. However, 
Galand does not describe ". . .analyzing the stored traffic log to determine. . .one or more nodes of 
a path traversed by the packet through the packet switched network from the network entry point 
to the network exit point. . .". As discussed above, there is no traffic log described in Galand. 
Because Galand does not describe a traffic log , Galand cannot describe analyzing the non- 
existent traffic log. 

Galand does describe a packet header. (Col. 6, 1. 60). However, Galand does not describe 
that a packet header is analyzed to "to determine. . .one or more nodes of a path traversed by the 
packet through the packet switched network from the network entry point to the network exit 
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point. . .". Since Galand does not describe "analyzing the stored traffic log to determine . . .one or 
more nodes of a path traversed by the packet through the packet switched network from the 
network entry point to the network exit point", Galand fails to cure this discrepancy in Sharon. 

As discussed above, Messinger merely describes that information may be collected by a 
router through which the data passes and that the information is stored in a separate file from 
which it is retrieved for display. Messinger fails to describe ". . .analyzing the stored traffic log 
to determine . . .one or more nodes of a path traversed by the packet through the packet switched 
network from the network entry point to the network exit point", because Messinger fails to 
describe a traffic log [specific to a particular packet]. Messinger further fails to describe 
determining . . .one or more nodes of a path traversed by the packet through the packet switched 
network from the network entry point to the network exit point". As such, Messinger fails to 
cure this discrepancy in the combination of Sharon and Galand. As such, amended independent 
claim 1 is allowable over the combination of Sharon, Galand and Messinger for this additional 
and independent reason. Claims 2-5, 7-13 depend from an allowable independent claim 1 and are 
allowable for at least the same reasons. 

Claims 14-39, 41-52 and 54-87 

Amended independent claim 14 recites, in pertinent part: 

"[a] method of monitoring packet traffic through a node of a packet-switched network 
using traffic logs, comprising. . .(b) generating a traffic log specific to a particular packet based 
upon detection of a content of the packet at a first location within the network based upon 
detection of the content of a packet 

As discussed above in regard to amended independent claim 1 , the combination of 
Sharon, Galand and Messinger fails to describe "generating. . .a traffic log specific to a 
particular packet based upon detection of a content of the packet at a first location. . .". As 
such, amended independent claim 14 is allowable over the combination of Sharon, Galand and 
Messinger for at least the same reasons. Amended independent claims 25, 36, 43, 49, 60, 69, 78 
and 84 recite similar subject matter and are allowable for at least the same reasons. Claims 15- 
24, 26-35, 37-39, 41-42, 44-48, 50-52, 54-59, 61-68, 70-77, 79-84 and 85-87 depend from an 
allowable independent claim 14, 25, 36, 43, 49, 60, 69, 78 or 84 and are allowable for at least the 
same reasons. 
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As to claim 36, in addition to reciting the allowable subject matter described above, 
Amended independent claim 36 also recites that the a packet includes a "traffic state indication 
of at least one of the following data elements: an "OK" state, an "illegal" state, a "congested" 
state and an "error" state. Applicants respectfully assert that the combination of Sharon, Galand 
and Messinger is silent concerning the use of a traffic state indication of at least one of the 
following data elements: an "OK" state, an "illegal" state, a "congested" state and an "error". 
As such, amended independent claim 36 is allowable over the combination of Sharon, Galand 
and Messinger for at least the additional and independent reason. 

Claims 2. 15. 26. 37. 46. 50. 61. 70. 79. and 85 

Claims 2, 15, 26, 37, 46, 50, 61, 70, 79, and 85 depend from an allowable independent 
claim 1 14, 25, 36, 43, 49, 60, 69, 78 or 84 and further recite that the histogram file is a flat file. 
The Office Action asserts that Messinger describes a histogram file that is a flat file and cites 
Col. 1, 1. 57-67; Col. 2, 1. 1-37; Col. 3, 1. 28-52; Col. 4, 1. 6-19 in support of its assertion. 
Applicants respectfully note that none of the citations, Messinger in general or the combination 
of Sharon, Galand and Messinger describes a histogram file that is a flat file. 

Applicants respectfully note that Messinger describes that information may be presented 
visually as a bar chart. (Col. 4, 1. 14-15). However, without conceding that a bar chart is a 
recited histogram, Applicants respectfully point out that Messinger is silent as to what kind of 
file the bar chart is derived from. Messinger merely describes the network files 204-208 as 
"information files" but never describes the type of file. Messinger clearly does not describe that 
the network files are flat files as opposed to a relational database file or other type of data 
structure. Applicants further assert that neither Sharon nor Galand describes a histogram file that 
is a flat file and respectfully points out that the Office Action concedes (see, page 6) that the 
combination of Sharon and Galand fails to describe the use of a histogram at all. For at least 
these reasons, the combination of Sharon, Galand and Messinger fails to describe that the 
histogram file is a flat file. As such, claims 2, 15, 26, 37, 46, 50, 61, 70, 79, and 85 are allowable 
over Sharon, Galand and Messinger for at least this independent reason. 
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Claims 7, 18, 29, 54, 63, and 72 

Claims 7, 18, 29, 54, 63 and 72 depend from an allowable independent claim 1, 14, 25, 
49, 60 or 69 and are allowable for a at least the same reasons. However, Applicants respectfully 
note that the combination of Sharon, Galand and Messinger fails to describe that the histogram 
plots packets per minute versus time. As described above, the Office Action concedes that the 
combination of Sharon and Galand fails to describe a histogram but proceeds by asserting that 
Messinger describes a bar chart and that the bar chart plots packet per minute versus time. 
Without conceding that Messinger' s bar chart is a histogram as recited, Applicants respectfully 
note that the cited portions of Messinger (Col. 1, 1. 57-67; Col. 2, 1. 1-37; Col. 3, 1. 28-52; Col. 4, 
1. 6-19) do not describe bar chart plots packets per minute versus time. Messinger merely 
describes that a parameter of interest may be the number of log-in attempts made from a 
particular computer by a hacker. (Col. 4, 1. 19-62). Plotting the number of log-in attempts made 
from a particular computer by a hacker is not plotting the number of packets per minute versus 
time. As such, Messinger fails to describe the subject matter asserted to it by the Office Action. 
Because the combination of Sharon, Galand and Messinger fails to describe plotting packets per 
minute versus time, claims 7, 18, 29, 54, 63 and 72 are allowable over the combination of 
Sharon, Galand and Messinger for at least this additional and independent reason. 

Conclusion 

In view of the foregoing amendments and remarks, this application is now in condition 
for allowance. A notice to this effect is respectfully requested. If the Examiner believes, after 
this amendment, that the application is not in condition for allowance, the Examiner is invited to 
call the Applicants' attorney at the number listed below. 
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No additional fees are believed due other than a one month extension of time. However, 
please charge any additional fees or credit any overpayment to Deposit Account No. 50-3025. 



Respectfully submitted, 

Date: February 13, 2008 

/Arno T. Naeckel/ 
Arno T. Naeckel 



Withers & Keys, LLC 
P.O. Box 71355 
Marietta, GA 30007-1355 
(678) 565-4748 
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